Configure effective QoS on MikroTik RouterOS
Reduce bufferbloat with CAKE, size the queue under real throughput, classify only useful flows, and prevent FastTrack from bypassing QoS.
An Internet connection may show 500 Mbit/s on a speed test and yet make a video conference painful as soon as a backup starts. The problem is not always a lack of bandwidth: it often comes from a queue that is too long, located in the box or at the operator. Large transfers fill it up, small interactive packets wait, and latency explodes. This phenomenon is called bufferbloat.
QoS does not create throughput. It organizes a limited capacity so that voice, interactive applications, and the Web remain responsive while downloads use what is left. On RouterOS 7, CAKE combines shaping, active queue management, flow fairness, and DiffServ support. For many small networks, it achieves a better result with fewer rules than a large port-based tree.
Choosing the right queue
RouterOS offers several disciplines. They do not all address the same problem.
| Type | What it does well | When to choose it |
|---|---|---|
| FIFO | Processes packets in order with very little computation | Uncongested link or very limited hardware ; no real protection against bufferbloat |
| PCQ | Distributes capacity among sub-flows, for example by source or destination address | Fair sharing among many clients, especially on older hardware |
| FQ-CoDel | Isolates flows and reduces the persistent queue | Good compromise when CAKE consumes too much CPU or when DiffServ is not needed |
| CAKE | Combines fairness, AQM, shaping, host isolation, and DiffServ classes | Recommended choice here for a home, lab, or small business Internet access |
CAKE, FQ-CoDel, and CoDel have been available in RouterOS since branch 7.1. Their CPU cost depends on throughput, packet size, and router model. There is therefore no universal table guaranteeing that a device will sustain 500 Mbit/s or 1 Gbit/s with CAKE : measure the load on your own configuration.
Selected architecture
This guide uses a Simple Queue for an IPv4 network, with a distinct CAKE type for sending and receiving. The upload applies dual-srchost so that a workstation opening many connections does not monopolize the upstream. The download uses dual-dsthost to fairly distribute data among LAN clients.
The examples assume :
- a LAN
192.168.88.0/24; - a stable measured throughput of 200 Mbit/s in reception and 20 Mbit/s in transmission ;
- a WAN interface already placed in the list
WANand local interfaces inLAN; - a router that performs IPv4 NAT itself.
Replace these values with your own. The order upload/download of a Simple Queue is important : in our example, 19M/190M means 19 Mbit/s towards the Internet and 190 Mbit/s towards the LAN.
1. Measure before configuring
Connect a computer via Ethernet, stop backups, and repeat several tests at different times. Keep the low value that is actually available, not the best result of the day. Also measure latency at rest and during a saturating transfer.
/ping 1.1.1.1 interval=200ms count=100Simultaneously start a download and then an upload from a client. If the ping goes, for example, from 12 ms to 150 ms, the link suffers from waiting under load. For a fixed access, start at 90–95 % of the observed low throughput. Here, 200/20 becomes 190/19. On a highly variable radio or cellular link, a larger margin may be necessary.
2. Back up and work in Safe Mode
A mistake on FastTrack or the queues can cut a remote session. Perform the first commissioning from the LAN, enable Safe Mode with Ctrl+X, then save an export and a binary backup.
/export file=avant-qos
/system backup save name=avant-qos
/system resource print
/queue type print
/queue simple print
/ip firewall filter print where action=fasttrack-connection3. Create the two CAKE types
The profile diffserv4 offers four easy-to-audit classes : Bulk, Best Effort, Video, and Voice. It is generally simpler to maintain than eight levels. The mode cake-nat=yes allows CAKE to find internal hosts behind NAT when applying fairness.
/queue type
add name=cake-upload kind=cake \
cake-bandwidth=19M \
cake-flowmode=dual-srchost cake-nat=yes \
cake-diffserv=diffserv4 cake-rtt-scheme=internet
add name=cake-download kind=cake \
cake-bandwidth=190M \
cake-flowmode=dual-dsthost cake-nat=yes \
cake-diffserv=diffserv4 cake-rtt-scheme=internetThe values cake-bandwidth must remain consistent with the max-limit of the Simple Queue. The RTT scheme internet corresponds to 100 ms and is suitable for the majority of Internet accesses. Do not choose lan to shape a connection to the Internet : this profile assumes a local Ethernet network of about 1 ms.
If the access uses PPPoE, VDSL, DOCSIS, or a VLAN, overhead compensation can improve accuracy. The correct cake-overhead-scheme depends on the actual encapsulation. Do not randomly copy a value found for another technology : ask the operator for the access mode or start with a conservative throughput margin.
4. Create the Simple Queue
/queue simple
add name="QoS Internet CAKE" target=192.168.88.0/24 \
max-limit=19M/190M \
queue=cake-upload/cake-downloadAvoid target=0.0.0.0/0 when the local subnet is known : a precise target limits ambiguities with router traffic, VPNs, and other networks. If multiple VLANs must share the same access, add their prefixes to the target or design an explicit hierarchy after checking the direction of flows.
5. Prevent FastTrack from bypassing the queue
FastTrack accelerates IPv4 TCP and UDP connections by making them bypass several RouterOS functions. MikroTik documentation specifies that it bypasses Simple Queues and Queue Trees whose parent is global. As long as the CAKE queue must handle all Internet access, the general FastTrack rule must therefore be disabled.
/ip firewall filter
disable [find where action=fasttrack-connection]Do not delete the rule : disabling it makes rollback easier. The CPU load will increase, sometimes significantly. Monitor it during a full-speed test.
/tool profile cpu=all duration=30
/queue simple print stats-detail where name="QoS Internet CAKE"
/queue type print detail where name~"cake-"If the processor reaches 100 % before the target throughput, reduce the speed, try FQ-CoDel, keep PCQ for sharing among clients, or use more powerful equipment. A CPU-limited test does not validate QoS.
6. Add DiffServ only where it brings something
CAKE already works without any classification rules : each flow receives a fair queue. So start in Best Effort mode and measure. Then add a few classes based on a clear policy, not a hundred ports.
Ports no longer allow properly identifying an application. HTTPS groups many uses on TCP 443, QUIC carries a large part of the Web and video on UDP 443, and applications can use dynamic ranges. Promoting all of port 443 would amount to giving priority to encrypted backups as much as to meetings.
A robust method consists of classifying dedicated terminals. The following example grants EF 46 to an IP phone and places a backup server in CS1 8. The connection mark makes the decision symmetric : the outgoing and return packets of the same connection receive the same DSCP. The rules connection-mark=no-mark avoid overwriting a mark already used by policy routing or a VPN.
/ip firewall address-list
add list=qos-voice address=192.168.88.20 comment="IP phone"
add list=qos-bulk address=192.168.88.50 comment="Backup server"
/ip firewall mangle
add chain=prerouting in-interface-list=LAN \
src-address-list=qos-voice connection-state=new \
connection-mark=no-mark action=mark-connection \
new-connection-mark=qos_voice passthrough=yes \
comment="QoS: voice connection"
add chain=prerouting connection-mark=qos_voice \
action=change-dscp new-dscp=46 passthrough=no \
comment="QoS: voix EF"
add chain=prerouting in-interface-list=LAN \
src-address-list=qos-bulk connection-state=new \
connection-mark=no-mark action=mark-connection \
new-connection-mark=qos_bulk passthrough=yes \
comment="QoS: backup connection"
add chain=prerouting connection-mark=qos_bulk \
action=change-dscp new-dscp=8 passthrough=no \
comment="QoS: sauvegarde CS1"For a video conference, reserve AF41 34 for a room terminal or a managed VLAN. Avoid promoting an entire general-purpose computer : its synchronizations and updates would inherit the same treatment. DNS, being very light, generally benefits more from a short queue than from an excessively high level.
7. Test the result
The useful test is not to find exactly the contractual throughput. It consists of saturating both directions while measuring latency and making a call.
- Measure the ping at rest for one minute.
- Saturate the download, then the upload, then both at the same time.
- Check that the counters of
QoS Internet CAKEincrease. - Verify throughput, latency under load, losses, and CPU load.
- Repeat with a real backup and a video conference.
/queue simple print stats-detail where name="QoS Internet CAKE"
/ip firewall mangle print stats where comment~"QoS:"
/ip firewall connection print where connection-mark~"qos_"
/system resource printA slight drop in maximum throughput is normal : it buys queue control. Adjust the ceiling in steps of 1 to 2 %. If latency still climbs sharply, lower it. If it remains stable and the line is underutilized, raise it cautiously.
Case of a variable throughput
CAKE offers cake-autorate-ingress to estimate a varying incoming capacity, for example on a cellular access. However, this function cannot correctly guess a limitation located further in the network under all conditions. On a stable link, a measured ceiling remains more predictable. On a variable link, test the autorate for several days and compare it to a conservative ceiling.
PCQ alternative for a more modest router
PCQ does not replace CAKE's AQM, but simply distributes capacity among hosts. RouterOS already provides pcq-upload-default with the classifier src-address and pcq-download-default with dst-address. For a limited device, you can keep the same ceiling and replace the queue types :
/queue simple
set [find where name="QoS Internet CAKE"] \
queue=pcq-upload-default/pcq-download-defaultSharing among clients will be fairer, but latency under congestion may remain less controlled. FQ-CoDel is often the intermediate step : better queue management than PCQ, fewer integrated functions than CAKE.
Troubleshooting
| Symptom | Likely cause | Action |
|---|---|---|
| Queue counters almost zero | FastTrack active or wrong target | Disable FastTrack, check the subnet and the upload/download direction |
| Throughput lower than the ceiling, CPU at 100 % | Router limited by software processing | Try FQ-CoDel/PCQ, reduce speed, or upgrade hardware |
| Latency always high | Ceiling too close to actual throughput or variable capacity | Reduce the max-limit and measure at several times |
| Voice does not take the Voice class | Incorrect address, mangle order, or connection mark | Check counters, interface lists, and existing marks |
| A workstation still hogs the link | Wrong flowmode or NAT not taken into account | Check dual-srchost/dual-dsthost and cake-nat=yes |
| Router becomes unstable | Queue too costly or risky remote change | Revert to Safe Mode, re-enable FastTrack, and restore the previous queue |
Rollback
The comments and explicit names allow removing only the elements of this guide.
/queue simple remove [find where name="QoS Internet CAKE"]
/ip firewall mangle remove [find where comment~"QoS:"]
/ip firewall address-list remove [find where list~"qos-"]
/queue type remove [find where name="cake-upload"]
/queue type remove [find where name="cake-download"]
/ip firewall filter enable [find where action=fasttrack-connection]The last command re-enables all disabled FastTrack rules. If multiple policies exist, re-enable the exact rule you noted before the change instead.
Conclusion
Effective QoS relies first on a realistic ceiling and a queue that fights bufferbloat. CAKE already knows how to share flows and hosts ; it is not necessary to recognize every service on the network. A few reliable classifications — managed phone, meeting room, backup — are worth more than a long list of ports that has become false.
The result is judged by latency under load, losses, call quality, and CPU load, not just the number from a speed test. With a Simple Queue placed just below the actual capacity, two CAKE profiles adapted to the traffic direction, and controlled FastTrack, RouterOS can keep a link responsive even when fully utilized.
Technical references
- MikroTik : RouterOS queues, Simple Queue, Queue Tree, PCQ, FQ-CoDel, and CAKE
- MikroTik : CAKE parameters, flow modes, DiffServ, and overhead compensation
- MikroTik : Connection Tracking and functions bypassed by FastTrack
- MikroTik : bandwidth sharing with PCQ
- IETF RFC 4594 : DiffServ class recommendations
Read next
About the author
Jeremy Kraft runs the infrastructure and the self-hosted services of the IBCSC. These guides describe configurations that were actually deployed and re-checked before publication.
Discussion
Comments
No comment yet. Feel free to open the discussion with a question or your own experience.